The Flock camera backlash isn’t really about security cameras

One of the most common complaints about security cameras was that nobody was watching them, ironically…

America may now be confronting the opposite problem; What happens when the cameras remember too much?

Over the past few weeks, automated license plate readers have found themselves at the center of an unusually intense US security debate.

Florida has moved to remove license plate readers from state highway rights-of-way. Missouri has introduced new safeguards governing their use. A sheriff’s deputy in Alabama has been dismissed following an audit of Flock camera searches. US senators have demanded answers from Flock Safety over allegations of misuse.

And on September 9, the US-based Security Industry Association published its own principles calling for responsible use of Automated License Plate Reader technology, or ALPR.

At first glance, this looks like a policing story.

For a security manager responsible for an office campus, shopping center, mixed-use development or commercial estate, it would be quite easy to keep scrolling.

That would be a mistake.

Because the controversy surrounding Flock is exposing a question that increasingly applies to almost every connected physical security system:

Who can access the information your security technology collects — and can you prove what they did with it?

Automated License Plate Reader systems work differently.

Cameras capture information including a vehicle’s license plate, characteristics, location and the date and time it was observed. That information becomes searchable rather than simply sitting in a recording waiting for somebody to rewind it.

Flock says its network now includes more than 120,000 cameras across 49 states.

The interesting number isn’t really 120,000. It is the connections between them.

One camera can tell you that a vehicle passed a particular location.

A connected network potentially allows investigators to establish that the same vehicle appeared somewhere else. Then somewhere else.

The security camera has gradually acquired something cameras historically lacked. A memory.

And memory is where things become complicated.

Missouri has taken a different approach.

On September 16, Governor Mike Kehoe signed an executive order establishing safeguards for ALPR technology used by organizations receiving state funding.

The order doesn’t reject the technology. Quite the opposite.

It seeks to retain what the state describes as legitimate law-enforcement uses while introducing rules around access, retention and misuse of location data.

Perhaps the emerging argument isn’t: Should we have the technology?

It is: What needs to surround the technology once we do?

The Security Industry Association’s Data Privacy Code of Practice for Access Control acknowledges exactly this tension. It notes that modern access and identity systems can provide scalable security and reduce demands on personnel, while the data they collect creates a separate risk of unauthorized access or disclosure.

Its recommendations for end users include purpose limitation, data minimization, least-privilege access, defined retention, vulnerability assessments and auditing access records for inappropriate or unusual activity.

Its equivalent guidance for video surveillance makes much the same point: organizations should restrict who can access retained images, establish why access is permitted and store footage only as long as reasonably necessary.

This isn’t theoretical territory reserved for Silicon Valley or federal surveillance debates.

It already applies to the systems sitting in commercial security control rooms.

Flock itself actively markets license plate reader technology to businesses, retail environments, apartment communities and commercial properties.

The Flock story is simply showing the issue at a scale large enough for everyone to notice.

Its guidance specifically highlights access controls, auditability and oversight capabilities as mechanisms technology providers should give customers to help prevent and detect misuse.

That’s an interesting moment for physical security.

For most of the industry’s history, the sales conversation has understandably concentrated on what technology can do. Now the conversation increasingly has to include what it shouldn’t do.

That’s not necessarily evidence that security technology has gone wrong. It may be evidence that it has grown up.

Cars eventually got seat belts. Computers eventually got passwords.

The more useful something becomes, the more attention we tend to pay to what happens when it is used badly.

None of those questions will make an impressive product video.

They may become some of the most important ones a security manager asks.